Cisco Umbrella Integration Guide🔗

The following instructions are for configuring a Cisco Umbrella integration to facilitate log ingestion into Secureworks® Taegis™ XDR.

XDR supports two integration paths for Umbrella log ingestion:

(Preferred) Integrate via Cisco-Managed S3 Bucket — This option is preferred as it does not require any XDR components to be deployed in your environment to enable log ingestion.
Integrate via Customer-Managed S3 Bucket — This option provides equivalent data to the Cisco-Managed S3 integration, but requires deployment of the XDR Lambda function in your AWS environment.

Data Provided from Integrations🔗

	Normalized Data	Out-of-the-Box Detections	Vendor-Specific Detections
Cisco Umbrella		DNS, HTTP, Netflow

Note

XDR detectors are not guaranteed to be triggered, even if a data source's logs are normalized to a schema associated with a given detector. However, you can create Custom Detection Rules to generate detections based on normalized data from a data source.

Start Cisco-Managed S3 Integration🔗

Prerequisites🔗

The following tasks must be completed in the Umbrella console prior to beginning the integration in XDR. Follow the instructions in the vendor documentation to configure Umbrella to log to a Cisco-managed S3 bucket.

Select Use Cisco-managed Amazon S3 storage.
Select a Region that is closest to the XDR environment in which your tenant resides.

Taegis Environment	AWS Region
US1	US East (Ohio)
US2	US East (Ohio)
US3	US West (Oregon)
EU1	Europe (Frankfurt)
EU2	Europe (Ireland)

Select any Retention Duration value.
Click Save and Continue.

When activation is complete, a summary page displays. Copy the Data Path, Access Key, and Secret Key values to a safe location. These values will be used to complete the Umbrella integration in XDR.

Important

The Data Path must be in the format: cisco-managed-<Region>/<ID>. For example, cisco-managed-us-west-1/2069997_6ff2802af17337def701c2e7816cf14913zf848a.

Add Integration in XDR🔗

From the Taegis Menu, select Integrations → Cloud APIs.
Select Add an Integration from the top of the page.

Add an Integration
From the Optimized tab, select Cisco Umbrella.

Set up Cisco Umbrella Integration
Enter the following fields:
- Taegis Integration Name — Any unique string
- Cisco Umbrella Access Key — Generated in the Prerequisites section
- Cisco Umbrella Secret Key — Generated in the Prerequisites section
- Cisco Umbrella Data Path — Generated in the Prerequisites section
Select Done. The Cloud API Integrations table displays the successfully added Cisco Umbrella integration.

Start Customer-Managed S3 Integration🔗

Note

If you do not have login access to XDR, have someone who does help you complete any steps that require access. You can also contact your Secureworks® representative for help.

From the Taegis Menu, select Integrations → Cloud APIs.
Select Add an Integration from the top of the page.

Add an Integration
From the Optimized tab, choose AWS and then select Setup under Cisco Umbrella.
Select Next.
Enter the Taegis Integration Name. This serves as a unique name for your integration; it can include any valid values up to 100 characters.
Select Done. The CloudFormation template automatically downloads as taegis-cloudformation-lambda-template.yaml.

Create an S3 Bucket for Cisco Umbrella🔗

To configure Cisco Umbrella log forwarding via your own customer-managed AWS S3 bucket, follow the steps in Cisco's own guide: Enable Logging to Your Own S3 Bucket.

The bucket you create will be used as the NotificationBucket parameter in the CloudFormation template.

Upload the CloudFormation Template to S3 (Optional)🔗

Log in to the AWS Console for the region (e.g., https://us-east-1.console.aws.amazon.com/cloudformation) with an account that has permissions to create roles, lambdas, secrets, and policies, or using a role that can assume another role with these permissions.
In the Storage section, select S3.
Create a new bucket or locate an existing bucket in which to store the CloudFormation template. The bucket does not need to be public, versioned, or encrypted.
Upload taegis-cloudformation-lambda-template.yaml to the same bucket.

Tip

Take note of the bucket name and the key, including any prefix. These identifiers are needed when you create a stack.

Create the Lambda Stack🔗

Log in to the AWS Console for the region (e.g., https://us-east-1.console.aws.amazon.com/cloudformation) with an account that has permissions to create roles, lambdas, secrets, and policies, or using a role that can assume another role with these permissions.
In the Management and Governance section, select CloudFormation.
Click Create Stack.

Note

You may see a list of CloudFormation stacks when you select CloudFormation like the following image. If that is the case, click Create Stack and choose With new resources (standard).

Create New Stack
In the Prerequisite - Prepare Template section, click Choose an existing template.
In the Specify Template section, click Upload a template file > Choose file.

Note

If you uploaded the template to an S3 bucket, you can specify the S3 URL instead.
Click Next.
Enter an appropriate stack name.

Note

Spaces are not allowed in stack names.
Select the IntegrationType drop-down. This describes what sort of log objects are in the NotificationBucket. If there's more than one type, or you are not sure, choose generic.

Update Lambda Stack Integration Type
In NotificationBucket, enter the bucket name, not a URL or URI, that houses the logs.
(Optional) Enter the appropriate value into the SNSNotificationarn field if you wish to use SNS notifications going forward instead of S3 notifications.
Leave the remaining fields as default.
Click Next.
Accept the acknowledgement statement: I acknowledge that AWS CloudFormation might create IAM resources.
Click Next.
Review all parameters and click Submit.
Wait at least 30 seconds, then click Refresh. The process may take a minute or more to finish. A status of CREATE_COMPLETE for the stack indicates the process has finished.

Add the Lambda Trigger🔗

In the AWS console, go to the Lambda service.
Locate the new Lambda by name. The default name is {STACKNAME}-scwx-tdr-lambda-{INTEGRATIONTYPE}. For example: ct-demo-scwx-tdr-lambda-awscloudtrail.
Click the Lambda name to open the stack's edit page.
Expand the Function overview section and click Add Trigger.
In the Trigger Configuration editor, select S3 from the drop-down menu. Optionally, use an SNS trigger configured with a previously created topic.
From the Bucket options, find the bucket containing the logs and select it.
From the Event Type options, choose All Object Create Events.
In the Prefix field, enter the bucket prefix where the logs are located. Leave this blank if no prefix is used.
Leave the Suffix field blank.
Accept the acknowledgment statement about the cost impact of a Lambda function.
Click Add. The configuration page for that Lambda displays again. A message at the top indicates that the trigger was added successfully. For example, The trigger wmikeking was successfully added to function Logs-TDR-Upload. The function is now receiving events from the trigger.
Important

AWS Lambda Concurrency Guidance🔗

The Reserved Concurrency value set by the Taegis XDR CloudFormation template (taegis-cloudformation-lambda-template.yaml) is 5. For more information regarding Lambda concurrency and the calculation of a value appropriate for your environment, please reference Lambda function scaling in AWS Docs.

Please reference the following AWS documentation to the identify the values to be used in the concurrency calulation:
- Average requests per second
- Average request duration in seconds
AWS Concurrent Execution Limit🔗

If you see the following error when running your Lambda:
AWS Concurrent Execution Limit

You need to request a quota increase from AWS to raise your concurrent execution limit. For more information, see Lambda quotas in AWS Docs.